在python / scapy中对流量进行采样

Question

i'm currently looking to implement a basic traffic sampler using python and I'm wondering how to efficiently implement the sampler interval between each capture. I am not using sFlow as I want to sample traffic on my NIC.

I have looked at scapy but it seems that it does not provide a sampling feature. Therefore, in the processing function attached to sniff (eg sniff(prn=XXX) ) should I implement myself a timer to check if a packet should be specifically processed ?

Otherwise, I have an idea with the following code (basic example):

#Packet sniffer in python
#For Linux

import socket

#create an INET, raw socket
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)

# receive a packet
while True:
  sleep(1) # Timer ?
  print s.recvfrom(65565)

I've looked in the socket creation as well but didn't find any suitable answer.

My question is, what is the most efficient, performance-wise, way to capture and sample traffic on a network interface ?

Answer 1

Well first of all, if you are going to have a delay/timer you need to import time or if you are using just sleep(n) to do from time import sleep . Secondly, it's my personal opinion that timers aren't really the best options for sniffing packets. Especially if you are filtering/looking for certain types of packets. Also to get any relevant details of a raw packet, you need to deconstruct it. The struct module in python is probably best for that and you need to know how to extract data from certain received packets. When receiving the packet data using s.recvfrom(65535) , this is stored in a tuple and you need to focus on the first element of this using something like:

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
while True:
    try:
        packet = s.recvfrom(65565)
        packet = packet[0]
        #begin to analyse and deconstruct packet data
    except:
        pass

Each packet of data in constructed in a way the you can extract useful information from each one of them. A simple search on how they are packed can help you on knowing how to deconstruct them and show information. Look into the struct module and that should set you off! If you really need a delay for some reason, I would use a maximum of sleep(0.5) .

For efficiency, you may want to implement threading. If your code is working fine, this wouldn't necessarily be needed but if you wanted to, you could start a thread to deconstruct a received packet WHILE your NIC is still receiving packets. It would look SOMETHING like this:

import socket
import thread

def deconstructPacket(packet):
    #code to deconstruct packet

s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
while True:
    try:
        packet = s.recvfrom(65565)
        packet = packet[0]
        thread.start_new_thread(deconstructPacket, packet)
    except:
        pass #or handle any errors

I hope this helped!!!